CVE-2026-44930 | THREATINT

Description

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

PUBLISHED Reserved 2026-05-08 | Published 2026-05-22 | Updated 2026-05-22 | Assigner apache

Problem types

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Product status

Default status

unaffected

4.2.0 (semver) before 4.2.1

affected

4.0.0 (semver) before 4.1.6

affected

Any version before 3.6.11

affected

References

www.openwall.com/lists/oss-security/2026/05/22/9

lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh vendor-advisory

cve.org (CVE-2026-44930)

nvd.nist.gov (CVE-2026-44930)

Download JSON